Ankura CTIX FLASH Update - May 5, 2023

Malware Activity

North Korean Threat Group Kimsuky Observed Using New "ReconShark" Tool in Latest Campaign

Researchers have discovered Kimsuky, a North Korean state-sponsored threat group also known as APT43, utilizing a new reconnaissance tool dubbed "ReconShark" during their latest campaign. This campaign has been targeting government organizations, research centers, think tanks, and universities in the United States, Asia, and Europe. ReconShark is noted to have expanded reconnaissance capabilities, including "unique execution instructions and server communication methods," and is delivered through spear-phishing emails to specifically targeted individuals. The emails involve malicious OneDrive links that lead victims into downloading password-protected malicious documents that have filenames relevant to the targeted user's subject matter. ReconShark is suspected to be the evolution of the malware "BabyShark" that the group utilized in its campaigns in 2018.